ledgar-live[.]app

This domain, ledgar-live.app, is actively impersonating Ledger, a hardware cryptocurrency wallet provider, to deceive users into disclosing sensitive wallet credentials and recovery phrases. The site presents itself as a legitimate Ledger access portal, likely employing social engineering tactics to trick victims into entering private keys or seed phrases under the pretense of restricted access or account verification. Such attacks enable threat actors to gain unauthorized control over cryptocurrency assets, leading to immediate and irreversible financial loss for affected users. Analysis of the domain infrastructure reveals multiple high-risk indicators. The domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.96.3 and is secured with an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy. Despite this, only 1 out of 95 security vendors on VirusTotal currently flag the domain as malicious, indicating low detection coverage and suggesting the campaign may still be in an early or evasive phase. No blocklist entries were observed at the time of analysis, further reducing visibility. Users who have visited ledgar-live.app or entered any credentials on the site should immediately cease all interaction and assume compromise. They must revoke access to any connected wallets, generate new wallet addresses, and transfer remaining assets to a secure, unrelated wallet using a known-clean device. It is critical to review all recent transactions for unauthorized activity and monitor for signs of persistent access. Additionally, users should report the domain to relevant security teams and cryptocurrency platforms to aid in takedown efforts and prevent further exploitation.